AshAi EUVD-2026-68306

The attacker must be an authenticated caller with invocation rights to an AshAi-exposed tool (PR:L per CVSS 4.0 vector). The targeted tool must be configured with an identity option on an update or destroy action - read-only tools are not exploitable. Exploitation is triggered by supplying a map value (predicate expression) rather than a scalar in the identity field of the tool call arguments; an omitted key also triggers exploitation via an IS NULL match. Deployments running ash_ai outside the 0.6.0-pre-1.0.0 range or those that do not expose identity-configured update/destroy tools are not affected. Limiting factors: (1) valid credentials or session token allowing tool invocation are required, (2) at least one update or destroy tool with identity configuration must be active in the deployment, and (3) the ash_ai version must be 0.6.0 or later but before 1.0.0.

The CVSS 4.0 score of 7.1 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N) is well-calibrated to the actual risk profile. Low privilege requirement (PR:L) confirms that any authenticated tool caller - no administrator or special role needed - can trigger the bypass, making the effective attack population broad within any deployment that exposes identity-configured tools. High integrity impact (VI:H) is appropriate because a successful exploit can modify or destroy arbitrary records, including wholesale table truncation via bulk operations. Low confidentiality impact (VC:L) reflects that filter behavior implicitly reveals record existence. No CISA KEV listing exists and no EPSS data was provided, so exploitation probability must be inferred: the attack complexity is genuinely low (a single crafted JSON argument suffices), and the advisory's detailed technical description significantly lowers the bar for reproduction. This is not a high-CVSS/low-real-risk case - the integrity damage potential is severe within affected deployments, and the only practical limiting factor is ash_ai's niche deployment footprint in the Elixir ecosystem.

An authenticated AI agent or API client with tool invocation rights sends a crafted JSON payload to an identity-configured update or destroy tool, supplying the identity field as a map predicate - for example, {"record_id": {"not_eq": "attacker-own-uuid"}} - instead of a scalar value. AshAi's identity_filter/3 passes this directly into Ash.Query.do_filter/2, which interprets the map as a filter expression matching all records except the attacker's own, then Ash.bulk_update! applies the write to the first matched record. No public POC has been identified, but the advisory's technical description provides sufficient detail for straightforward reproduction by a motivated attacker.